CVE-2026-93506: Server-Side Request Forgery in SveltyCMS
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
AI Analysis
Technical Summary
SveltyCMS 0.0.6 contains a server-side request forgery vulnerability in the File Upload Endpoint component, specifically in the processing of /mediagallery/upload-media. This flaw allows remote attackers to manipulate requests, causing the server to perform unauthorized requests to internal or external resources. The vulnerability has been assigned CVE-2026-93506 with a CVSS 4.0 base score of 5.3 (medium severity). A patch identified by commit 05b4f9efeb79e9d72a693232334d7529687f896f is available and should be applied to mitigate the risk.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise accessible. This could lead to information disclosure or further attacks leveraging the server's network access. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges.
Mitigation Recommendations
Apply the patch identified by commit 05b4f9efeb79e9d72a693232334d7529687f896f to SveltyCMS version 0.0.6 to remediate this SSRF vulnerability. No vendor advisory or official fix details were provided beyond this patch reference. Patch status is not yet confirmed in vendor advisories; therefore, verify with the vendor or official repository for the latest remediation guidance.
CVE-2026-93506: Server-Side Request Forgery in SveltyCMS
Description
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
CVSS v4.0
Score 5.3medium
Affected software
SveltyCMS
pkg:github/sveltycms/SveltyCMScpe:2.3:a:sveltycms:sveltycms:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SveltyCMS 0.0.6 contains a server-side request forgery vulnerability in the File Upload Endpoint component, specifically in the processing of /mediagallery/upload-media. This flaw allows remote attackers to manipulate requests, causing the server to perform unauthorized requests to internal or external resources. The vulnerability has been assigned CVE-2026-93506 with a CVSS 4.0 base score of 5.3 (medium severity). A patch identified by commit 05b4f9efeb79e9d72a693232334d7529687f896f is available and should be applied to mitigate the risk.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise accessible. This could lead to information disclosure or further attacks leveraging the server's network access. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges.
Mitigation Recommendations
Apply the patch identified by commit 05b4f9efeb79e9d72a693232334d7529687f896f to SveltyCMS version 0.0.6 to remediate this SSRF vulnerability. No vendor advisory or official fix details were provided beyond this patch reference. Patch status is not yet confirmed in vendor advisories; therefore, verify with the vendor or official repository for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-18T08:26:52.415Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad527255bf5e2cf5282ffc
Added to database: 09/18/2026, 15:02:10 UTC
Last enriched: 09/18/2026, 15:16:40 UTC
Last updated: 09/19/2026, 03:47:17 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.